diff --git a/mod/data/export.php b/mod/data/export.php
index 9ba42f6f12d..b63630cc079 100644
--- a/mod/data/export.php
+++ b/mod/data/export.php
@@ -49,7 +49,7 @@ foreach ($fieldrecords as $fieldrecord) {
     $fields[]= data_get_field($fieldrecord, $data);
 }
 
-$mform = new mod_data_export_form('export.php?d='.$data->id, $fields);
+$mform = new mod_data_export_form('export.php?d='.$data->id, $fields, $cm);
 
 if($mform->is_cancelled()) {
     redirect('view.php?d='.$data->id);
diff --git a/mod/data/export_form.php b/mod/data/export_form.php
index a7641c32397..75e6f9c9a84 100644
--- a/mod/data/export_form.php
+++ b/mod/data/export_form.php
@@ -8,10 +8,13 @@ require_once($CFG->libdir . '/csvlib.class.php');
 
 class mod_data_export_form extends moodleform {
     var $_datafields = array();
+    var $_cm;
+
      // @param string $url: the url to post to
      // @param array $datafields: objects in this database
-    function mod_data_export_form($url, $datafields) {
+    function mod_data_export_form($url, $datafields, $cm) {
         $this->_datafields = $datafields;
+        $this->_cm = $cm;
         parent::moodleform($url);
     }
 
@@ -53,7 +56,7 @@ class mod_data_export_form extends moodleform {
         }
         $this->add_checkbox_controller(1, null, null, 1);
         require_once($CFG->libdir . '/portfoliolib.php');
-        if (true) { // @todo penny replace with permissions check
+        if (has_capability('mod/data:exportallentries', get_context_instance(CONTEXT_MODULE, $this->_cm->id))) {
             if ($portfoliooptions = portfolio_instance_select(
                 portfolio_instances(),
                 call_user_func(array('data_portfolio_caller', 'supported_formats')),